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1. Introduction 


Change Management is the practice of ensuring the delivery of IT and Business Services is not 
impacted by infrastructure or software changes and all changes are recorded and carried out in 
a planned and authorised manner. This includes ensuring there is a business reason behind 
each change, identifying the specific configuration items and IT services affected by the change, 
identifying those staff responsible for implementing the change, planning the change, testing the 
change, and having a back-out plan should the change result in an unexpected failure. 

2. Objectives 

The goal of the Change Management Policy is to define the requirements necessary to meet 
the following business objectives: 

• Reduce the risk of business disruption from information systems and infrastructure 
changes. 

• Improve communication among stakeholders that may initiate and / or be impacted by 
changes. 

• Comply with internal control and regulatory requirements. 

3. Background 

Change Management is the practice of ensuring the delivery of IT and Business services is not 
impacted by infrastructure or software changes and all changes are recorded and carried out in 
a planned and authorised manner. 

This includes ensuring there is a business reason behind each change, identifying the specific 
Configuration Items and IT services affected by the change, identifying those staff responsible 
for implementing the change, planning the change, testing the change, and having a back out 
plan should the change result in an unexpected failure. 

The goal of Change Management is to manage the process of change to these systems through 
standardised methods and procedures, thereby limiting incidents related to change and 
improving day-to-day operations. 

Without formal change management polices and governance there is scope for operational 
inefficiency in the Municipality systems. 
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4. Scope 

This policy applies to all Ulundi Municipality employees, contractors, and any other individuals 
involved in making changes to Ulundi Municipality's production, technical and information assets 
for which IT has accountability. 

5. Definitions 

Change: A change is any activity that occurs to any information resource where the status is 
different from a previously defined condition. This is applicable to all ICT hardware, 
communications equipment and software, business systems software, ‘live’ applications 
software and all documentation and procedures that are relevant to the running, support and 
maintenance of live systems. A change can also be initiated to resolve a critical problem. 


User (s): For the purposes of this document any reference to ‘user’ or ‘users’ is referring to the 
business users who initiate the change request. 

Emergency Change: An emergency change is an unexpected or unplanned change that will 
either minimise service disruption or restore service. 

Change management: is the process of developing a planned and documented approach to 
change in an organization. 

In the ITIL framework, Change Management is responsible for controlling change to all 
configuration items within the live environment, test and training environments, and all 
environments under the control of 'ICT Operations'. 

Business owner: Manager of an organisational unit within Ulundi Municipality who bears 
responsibility for the acquisition, development and maintenance of production applications that 
process Municipality information. 

Configuration Items: A component within a system configuration that needs to be controlled 
e.g. PC, server, switch, and printer. 

ITIL: United Kingdom's Office of Government Commerce Information Technology Infrastructure 
Library. 
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6. Policy 

a. Every change to Ulundi Municipality production information resources is subject to the 
Change Management Policy and must follow the approved Ulundi Municipality Change 
Management Procedure. 

b. Procedures must exist to govern emergency changes to information systems and related 
technology. Criteria that define an emergency change must be clearly documented and 
communicated. Emergency changes must be documented. Emergency changes must 
be approved by a member of IT management authorized to approve emergency 
changes. 

c. Testing of changes must be performed prior to the change being implemented; proof of 
testing must be retained as evidence. 

d. A system must be in place to support the recording and tracking of changes made to 
information systems. If customer notification is required, it must be completed for each 
change following the steps contained in Ulundi Municipality’s Change Management 
Procedures document. 

e. Technical and user documentation must be updated to reflect changes made to 
information systems and related technology. A process must be defined for reviewing 
changes to ensure successful implementation. 

f. A central repository must exist to contain all relevant information on configuration items. 
This repository includes hardware, application software, middleware, parameters, 
documentation, procedures and tools for operating, accessing and using the systems 
and services. 

7. Segregation of Duties 

Segregation of duties (SoD) must be practiced to ensure that no single individual has the 
authority to execute multiple conflicting tasks with potential to impact other systems or 
information; and that no single individual can execute conflicting end-to-end transactions. 

As such, segregation of duties at Ulundi Municipality with regards to program changes must 
follow the best practice guidelines as stipulated below: 


The role of... 

Must be independent of ... 

Requester 

Implementer 

Builder 

Operators of the production 
environment 

Builder 

Tester 

Builder 

Implementer 
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Builder 

At least one approver 

Requester 

At least one approver 

Implementer 

At least one approver 

Implementer 

Reviewer 

Auditor 

All participants of a specific change 

Approver 

All other roles listed above 


8. Controls 

This policy document addresses the following control objectives: 


Control Objective Name 

Control Objective Detail 

Change Standards and 
Procedures 

Set up formal change management procedures to 
handle in a standardized manner all requests (including 
maintenance and patches) for changes to applications, 
procedures, processes, system and service 
parameters, and the underlying platforms. 

Impact Assessment, Prioritization 
and Authorization 

Ensure that all requests for changes are assessed in a 
structured way for impacts on the operational system 
and its functionality. This assessment should include 
categorization and prioritization of changes. Prior to 
migration to production, changes are authorized by the 
appropriate stakeholder. 

Emergency Changes 

Establish a process for defining, raising, assessing and 
authorizing emergency changes that do not follow the 
established change process. Documentation and 
testing should be performed, possibly after 
implementation of the emergency change. 

Change Status Tracking and 
Reporting 

Establish a tracking and reporting system for keeping 
change requestors and relevant stakeholders up to date 
about the status of the change to applications, 
procedures, processes, system and service 
parameters, and the underlying platforms. 

Change Closure and 
Documentation 

Whenever system changes are implemented, update 
the associated system and user documentation and 
procedures accordingly. Establish a review process to 
ensure complete implementation of changes. 


Configuration Repository and Establish a central repository to contain all relevant 

Baseline information on configuration items. This repository 

_ includes hardware, application software, middleware, 


IT Change Management, Ulundi Municipality 


6 







parameters, documentation, procedures and tools for 
operating, accessing and using the systems and 
services. Relevant information to consider is naming, 
version numbers and licensing details. A baseline of 
configuration items should be kept for every system and 
service as a checkpoint to which to return after 
changes. 


9. Cross-Reference to Other Policies and Procedures 

Change Management Procedure. 

10. Reference Material Used In Developing This Policy/Procedure 

• ITIL v4 Framework 

11. Accountabilities 

11.1. Responsibility 

All Business Owners and IT staff are required to adhere to this policy. Non-compliance to 
this policy by a staff member may lead to appropriate disciplinary action by IT management. 

11.2. Training Plan 

All business owners and managers are responsible for promoting individual employee 
awareness of, and compliance with, Municipality Change Management policies and 
procedures. 

11.3. Compliance 


All Business owners of Municipality systems must comply with this policy. 

12. Approvals 

The table below provides necessary approvals of this policy. 


Approver 

Signature 

Date 

Chairman of the Council 



Chairman of the Audit and Risk 
Committee 



Ulundi Municipal Manager 
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